On November 13, 2019, AWS added a new field EncryptionResponse to the decrypt message response from KMS. This is not documented here as of the filing of this ticket.
EncryptionAlgorithm: "SYMMETRIC_DEFAULT",
As a result, 4.2.0, and 4.2.1 shell cannot work with AWS KMS